This bug is weird. it only happens with my main profile. I created a blank new
one, did not touch to cookies advanced settings and it crashes again.
I will download a nightly with talkback and send a TB ID.

Created attachment 117791[details][diff][review]
Proposed patch
So the problem is that nsImageDocument::CreateSyntheticDocument gets called
before the document has a scriptglobalobject.... The resulting call into the
content policy code with a null domwindow crashes.
The best solution, imo, is to move the CreateSyntheticDocument call. One issue
is that now we will not be erroring out of StartDocumentLoad but rather out of
SetScriptGlobalObject on out-of-memory and such.... I don't think this is a
big deal.
Other solutions that would work: make content policy handle null windows
(should maybe still do that), make GetScriptGlobalObject go to the docshell if
mScriptGlobalObject is null (seems a little risky).